Overview

overview

8

Static

static

3

2026-08-01...wk.exe

windows10-2004-x64

8

2026-08-01...wk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    53s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 03:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_3f7f47e474e207d2ca56e3bcb7dbacb8_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
  • Size 27.5MB
  • Sample260801-d1lyjsxale
  • SHA256 7fb1dc9f44baa0fd4d261d2490d4f408282d8415367541c401a182a80b9e560f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_3f7f47e474e207d2ca56e3bcb7dbacb8_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_3f7f47e474e207d2ca56e3bcb7dbacb8_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4868
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_3f7f47e474e207d2ca56e3bcb7dbacb8_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_3f7f47e474e207d2ca56e3bcb7dbacb8_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2652

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 27.5MB
        • SHA256 7fb1dc9f44baa0fd4d261d2490d4f408282d8415367541c401a182a80b9e560f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 53.1MB
        • SHA256 8fccbd2f737e244cb267f65dfee7ed754fbce7c37d508b8497681e000fb69394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 49.8MB
        • SHA256 f1efb63fa166774d821add715e546872b531650383af6f5125a001ccd490842f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 48.8MB
        • SHA256 0add0166b629f0c43dee5783c349b8c2d25388bfcc7257730bca91aebf06e1e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 29.7MB
        • SHA256 a1a13774a0fb3ed3518d3f5b7fa448291c9ab47d38d25e9cd58db4002f5ce58a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 45.6MB
        • SHA256 98bf071721d992471d79d6d10d7c696bb4479e893f447b36a9655abc7cae72ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismountMount.exe
        • Path C:\Program Files\DismountMount.exe
        • Size 44.9MB
        • SHA256 a6d5c15e87596bf0198d0942bab1f49e71d477bd38e2a0b84e90566944f0978a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 39.0MB
        • SHA256 c8bbb5f1161c650a0f7ab49303fbd9bfae0a0fd4b17b19912a62e4b90392c51d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 39.2MB
        • SHA256 51344d082352bb47ece325559c6221d2e7c9289a16ae0d473a09df7f13768425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.0MB
        • SHA256 bd241e8b523f0a75b73e1256c1848916690d3600d8e73892d7927eda6900a8ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 39.4MB
        • SHA256 74bf36334b63dca4bfd12c424ab269c31e57f01c1a3a1a267f56a6576296530c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.9MB
        • SHA256 cac0bbbdf3d4dad042dcad8e0319c00df8ead640feb634c460313cd0260eb7f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 39.8MB
        • SHA256 a3a447744b2a1d790f6228dfb73a30fe89f431e167625eec9d879a98f663ded5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.6MB
        • SHA256 7fc296b5eb4c569f4e8d746cecce203043599c3947df439d9b865d32b81d1045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 41.6MB
        • SHA256 1a3857d074028c2f0e000ebc6da5a10fd7bdd4cc0af4ff2a684c9695724323dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.9MB
        • SHA256 c63efc9cba3c12fe734be1e1556c26d6f43b1a79c1449613151a984e9c5f87e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 39.4MB
        • SHA256 6620beeb9d478d934d3c8b72ccd898ef7d31fcd5d726e8cb7f9de374b584fc1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.3MB
        • SHA256 8f2a2d758fe10b1085eb95e4998ce9f6f2b0bf03c38c2168529141694cbf6c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.9MB
        • SHA256 958ac29f168804e630b2c217dd3043af42c6e213632c03725d696a94c5e6ac93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.6MB
        • SHA256 feb22e43364c70cb6035a2b1393035464a3c0dbbbfff3c2689108fd023949691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.4MB
        • SHA256 313e5051a57302f415f122ce3ee393f52bb2a6fb1163f718c5ec22a70f3b5c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.6MB
        • SHA256 a6be03fa67de135f50eb2b80e20ee6594a7cdad978cf57863e7f66b85463fa47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.9MB
        • SHA256 98fcfb4a79794ae2519b038548d1a146eb2a537deca66fc50a0842dad3d6cad8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.2MB
        • SHA256 e91328b9e2cd4e6b0254ece6b7e7f932c3b05998599209843b0db34d35ea2f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.1MB
        • SHA256 6e0a21c46a6021c74fd69044e9ade35ee09c2fbb4b8fbead3612a9121d98283b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.2MB
        • SHA256 880122c291eb5246605ab0454e956adfb08a41087e0a8a46bb77840910bef409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.0MB
        • SHA256 50c64a7709ff377dce021d4d290423f49fb0c10fa9ec1f0e66afc0fe3b7e998e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.3MB
        • SHA256 929990d81d0df74861cec568077c557adb246ed20523c7245b61d3cf0798393b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.1MB
        • SHA256 6b6d2119786524d9444bc65f5f5b6a6486393077824220b02834a64aa7682131
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.6MB
        • SHA256 61d3fcf17c6851df09c1f5e990033b4ee6fe1cb9a855d3c7ff145bd6c05b5f1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.1MB
        • SHA256 ac297d37afb6903b41db37218884382d5afa823d26ca9fa6c7c994b547f0ea69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.5MB
        • SHA256 ea55894e9693dbec13c53fda001dee015440258a6a0e74a0095acdf7d7dbb03a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.4MB
        • SHA256 76f79e4960e68291942bcc17a1c54effff59d17f376cdb898257fc3a617321ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 35.7MB
        • SHA256 d5cf96902449123458166fd30aa175e7f39db9026abf0adf5cd0328611935403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 35.5MB
        • SHA256 fb8ab10b356fac35ef7478c9456312147fc703c388fd6aec0f790ae9c19c597a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.4MB
        • SHA256 fd4cdebb71d39f50d044cc8fc6cd3b806deee522b2ae16cf126480e6ded11632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.9MB
        • SHA256 145d752bb76cbbf2e5b5278a243d022e87ce58a1243f9da1e1622239e0cbe154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.9MB
        • SHA256 17c2bc866a6afa485767d9a5b74c9c3e7f402d5ac3ddc1fa6339584408b3a7dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.6MB
        • SHA256 03624b33395410b8056e1197312daad0afc86a360e2e3ef3ef7cb876daac52fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 35.4MB
        • SHA256 4072da7287dd72db93968a32acffb76850f27a3fe85ef45fe367bd2045c1ad5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.7MB
        • SHA256 0fcbfd6c0bba3556ae1010c81337432c2bc092735786c7de8fcecbae1c195f84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.6MB
        • SHA256 d28b71194174421b843bbbac37db2b363842c4104827d47af281e9d5ca11cf3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.4MB
        • SHA256 af2e26cd0713b619354334326d1a5c10560ea66dddc66ac517fc69b7769d20b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 33.9MB
        • SHA256 56d246af270878db3edf32e4a614366ee26abc654d6bdea5cd22ab4a818761e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.6MB
        • SHA256 dcb2867a91bdc208a4fff92c2bc7b31df0e337a136dca6a6c1152ec284abac41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.5MB
        • SHA256 a753a7d36e7227bb90f43e9ae0feb71c7a0dcf11fc1462fec6c0e3f4fadaa7b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 32.5MB
        • SHA256 460832d20823d22a44ef974b2d52d42f589106e6167e99a6fb212cf845d79324
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 33.2MB
        • SHA256 665f849bf3297e259165e0b4288694bb5c86d73eb5524e06a34483347b783271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.8MB
        • SHA256 69779e11ee2607ddf620fdbc71ce8ce8d1faa4349ea84f95a08b481218c8a0e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 33.2MB
        • SHA256 cbe9fa875f9abb64ccff3acbe67e982c7effe206920408c0b53949525279f671
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.2MB
        • SHA256 88fb3c3801775eb66dca2b380967d52fc203d633c9a4964dda19804062ba3f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.5MB
        • SHA256 2487cb06ab1a90940705bd122b7761c5df882df1278d63e11ec6f0b3cee4dde3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 48.2MB
        • SHA256 561d4501040b75ae5a37e836c4d2b501f986fec1e181f35f1d1d385aaf785d46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 46.6MB
        • SHA256 7c4994fe69eb4c2d55c74b31f0e4b94b34242190120e13df6bbab97aedaed539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 45.4MB
        • SHA256 dc2653d90daf1438196336bc340b9b11baba394b81f2eb2f8c9d6b19383a01db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 42.4MB
        • SHA256 af2bd78bd73e6a4eba97914edd17580b421d2b9bd45cc45027ccf9bda003a79a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download